* [PATCH] ksmbd: fix leak of transform buffer on encrypt_resp() failure
@ 2025-11-04 10:02 Qianchang Zhao
0 siblings, 0 replies; 7+ messages in thread
From: Qianchang Zhao @ 2025-11-04 10:02 UTC (permalink / raw)
To: harm0niakwer; +Cc: Qianchang Zhao, Zhitong Liu, stable
When encrypt_resp() fails at the send path, we only set
STATUS_DATA_ERROR but leave the transform buffer allocated (work->tr_buf
in this tree). Repeating this path leaks kernel memory and can lead to
OOM (DoS) when encryption is required.
Reproduced on: Linux v6.18-rc2 (self-built test kernel)
Fix by freeing the transform buffer and forcing plaintext error reply.
Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
---
fs/smb/server/server.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 7b01c7589..15dd13e76 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -246,11 +246,11 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,
rc = conn->ops->encrypt_resp(work);
if (rc < 0) {
conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
- work->encrypted = false;
- if (work->tr_buf) {
- kvfree(work->tr_buf);
- work->tr_buf = NULL;
- }
+ work->encrypted = false;
+ if (work->tr_buf) {
+ kvfree(work->tr_buf);
+ work->tr_buf = NULL;
+ }
}
}
if (work->sess)
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH] ksmbd: fix leak of transform buffer on encrypt_resp() failure
[not found] <2025110432-maimed-polio-c7b4@gregkh>
@ 2025-11-04 10:03 ` Qianchang Zhao
2025-11-04 11:51 ` Namjae Jeon
2025-11-04 14:12 ` Qianchang Zhao
1 sibling, 1 reply; 7+ messages in thread
From: Qianchang Zhao @ 2025-11-04 10:03 UTC (permalink / raw)
To: Namjae Jeon, Steve French
Cc: Sergey Senozhatsky, Tom Talpey, linux-cifs, linux-kernel, gregkh,
Qianchang Zhao, Zhitong Liu, stable
When encrypt_resp() fails at the send path, we only set
STATUS_DATA_ERROR but leave the transform buffer allocated (work->tr_buf
in this tree). Repeating this path leaks kernel memory and can lead to
OOM (DoS) when encryption is required.
Reproduced on: Linux v6.18-rc2 (self-built test kernel)
Fix by freeing the transform buffer and forcing plaintext error reply.
Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
---
fs/smb/server/server.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 7b01c7589..15dd13e76 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -246,11 +246,11 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,
rc = conn->ops->encrypt_resp(work);
if (rc < 0) {
conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
- work->encrypted = false;
- if (work->tr_buf) {
- kvfree(work->tr_buf);
- work->tr_buf = NULL;
- }
+ work->encrypted = false;
+ if (work->tr_buf) {
+ kvfree(work->tr_buf);
+ work->tr_buf = NULL;
+ }
}
}
if (work->sess)
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] ksmbd: fix leak of transform buffer on encrypt_resp() failure
2025-11-04 10:03 ` Qianchang Zhao
@ 2025-11-04 11:51 ` Namjae Jeon
0 siblings, 0 replies; 7+ messages in thread
From: Namjae Jeon @ 2025-11-04 11:51 UTC (permalink / raw)
To: Qianchang Zhao
Cc: Steve French, Sergey Senozhatsky, Tom Talpey, linux-cifs,
linux-kernel, gregkh, Zhitong Liu, stable
On Tue, Nov 4, 2025 at 7:03 PM Qianchang Zhao <pioooooooooip@gmail.com> wrote:
>
> When encrypt_resp() fails at the send path, we only set
> STATUS_DATA_ERROR but leave the transform buffer allocated (work->tr_buf
> in this tree). Repeating this path leaks kernel memory and can lead to
> OOM (DoS) when encryption is required.
>
> Reproduced on: Linux v6.18-rc2 (self-built test kernel)
>
> Fix by freeing the transform buffer and forcing plaintext error reply.
>
> Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
> Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
> ---
> fs/smb/server/server.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
> index 7b01c7589..15dd13e76 100644
> --- a/fs/smb/server/server.c
> +++ b/fs/smb/server/server.c
> @@ -246,11 +246,11 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,
> rc = conn->ops->encrypt_resp(work);
> if (rc < 0) {
> conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
> - work->encrypted = false;
> - if (work->tr_buf) {
> - kvfree(work->tr_buf);
> - work->tr_buf = NULL;
> - }
> + work->encrypted = false;
> + if (work->tr_buf) {
> + kvfree(work->tr_buf);
> + work->tr_buf = NULL;
> + }
This patch seems to be broken or wrong. Please check the patch again.
Thanks!
> }
> }
> if (work->sess)
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] ksmbd: fix leak of transform buffer on encrypt_resp() failure
@ 2025-11-04 14:09 Qianchang Zhao
0 siblings, 0 replies; 7+ messages in thread
From: Qianchang Zhao @ 2025-11-04 14:09 UTC (permalink / raw)
To: harm0niakwer; +Cc: Qianchang Zhao, Zhitong Liu, stable
When encrypt_resp() fails at the send path, we only set
STATUS_DATA_ERROR but leave the transform buffer allocated (work->tr_buf
in this tree). Repeating this path leaks kernel memory and can lead to
OOM (DoS) when encryption is required.
Reproduced on: Linux v6.18-rc2 (self-built test kernel)
Fix by freeing the transform buffer and forcing plaintext error reply.
Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
---
fs/smb/server/server.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 40420544c..15dd13e76 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -244,8 +244,14 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,
if (work->sess && work->sess->enc && work->encrypted &&
conn->ops->encrypt_resp) {
rc = conn->ops->encrypt_resp(work);
- if (rc < 0)
+ if (rc < 0) {
conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
+ work->encrypted = false;
+ if (work->tr_buf) {
+ kvfree(work->tr_buf);
+ work->tr_buf = NULL;
+ }
+ }
}
if (work->sess)
ksmbd_user_session_put(work->sess);
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH] ksmbd: fix leak of transform buffer on encrypt_resp() failure
@ 2025-11-04 14:11 Qianchang Zhao
0 siblings, 0 replies; 7+ messages in thread
From: Qianchang Zhao @ 2025-11-04 14:11 UTC (permalink / raw)
To: harm0niakwer; +Cc: Qianchang Zhao, Zhitong Liu, stable
When encrypt_resp() fails at the send path, we only set
STATUS_DATA_ERROR but leave the transform buffer allocated (work->tr_buf
in this tree). Repeating this path leaks kernel memory and can lead to
OOM (DoS) when encryption is required.
Reproduced on: Linux v6.18-rc2 (self-built test kernel)
Fix by freeing the transform buffer and forcing plaintext error reply.
Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
---
fs/smb/server/server.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 40420544c..15dd13e76 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -244,8 +244,14 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,
if (work->sess && work->sess->enc && work->encrypted &&
conn->ops->encrypt_resp) {
rc = conn->ops->encrypt_resp(work);
- if (rc < 0)
+ if (rc < 0) {
conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
+ work->encrypted = false;
+ if (work->tr_buf) {
+ kvfree(work->tr_buf);
+ work->tr_buf = NULL;
+ }
+ }
}
if (work->sess)
ksmbd_user_session_put(work->sess);
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH] ksmbd: fix leak of transform buffer on encrypt_resp() failure
[not found] <2025110432-maimed-polio-c7b4@gregkh>
2025-11-04 10:03 ` Qianchang Zhao
@ 2025-11-04 14:12 ` Qianchang Zhao
2025-11-05 5:14 ` Namjae Jeon
1 sibling, 1 reply; 7+ messages in thread
From: Qianchang Zhao @ 2025-11-04 14:12 UTC (permalink / raw)
To: Namjae Jeon, Steve French
Cc: Sergey Senozhatsky, Tom Talpey, linux-cifs, linux-kernel, gregkh,
Qianchang Zhao, Zhitong Liu, stable
When encrypt_resp() fails at the send path, we only set
STATUS_DATA_ERROR but leave the transform buffer allocated (work->tr_buf
in this tree). Repeating this path leaks kernel memory and can lead to
OOM (DoS) when encryption is required.
Reproduced on: Linux v6.18-rc2 (self-built test kernel)
Fix by freeing the transform buffer and forcing plaintext error reply.
Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
---
fs/smb/server/server.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 40420544c..15dd13e76 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -244,8 +244,14 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,
if (work->sess && work->sess->enc && work->encrypted &&
conn->ops->encrypt_resp) {
rc = conn->ops->encrypt_resp(work);
- if (rc < 0)
+ if (rc < 0) {
conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
+ work->encrypted = false;
+ if (work->tr_buf) {
+ kvfree(work->tr_buf);
+ work->tr_buf = NULL;
+ }
+ }
}
if (work->sess)
ksmbd_user_session_put(work->sess);
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] ksmbd: fix leak of transform buffer on encrypt_resp() failure
2025-11-04 14:12 ` Qianchang Zhao
@ 2025-11-05 5:14 ` Namjae Jeon
0 siblings, 0 replies; 7+ messages in thread
From: Namjae Jeon @ 2025-11-05 5:14 UTC (permalink / raw)
To: Qianchang Zhao
Cc: Steve French, Sergey Senozhatsky, Tom Talpey, linux-cifs,
linux-kernel, gregkh, Zhitong Liu, stable
On Tue, Nov 4, 2025 at 11:12 PM Qianchang Zhao <pioooooooooip@gmail.com> wrote:
>
> When encrypt_resp() fails at the send path, we only set
> STATUS_DATA_ERROR but leave the transform buffer allocated (work->tr_buf
> in this tree). Repeating this path leaks kernel memory and can lead to
> OOM (DoS) when encryption is required.
>
> Reproduced on: Linux v6.18-rc2 (self-built test kernel)
>
> Fix by freeing the transform buffer and forcing plaintext error reply.
>
> Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
> Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
> ---
> fs/smb/server/server.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
> index 40420544c..15dd13e76 100644
> --- a/fs/smb/server/server.c
> +++ b/fs/smb/server/server.c
> @@ -244,8 +244,14 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,
> if (work->sess && work->sess->enc && work->encrypted &&
> conn->ops->encrypt_resp) {
> rc = conn->ops->encrypt_resp(work);
> - if (rc < 0)
> + if (rc < 0) {
> conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
> + work->encrypted = false;
> + if (work->tr_buf) {
> + kvfree(work->tr_buf);
->tr_buf is freed in ksmbd_free_work_struct(). How can tr_buf not be freed?
Thanks.
> + work->tr_buf = NULL;
> + }
> + }
> }
> if (work->sess)
> ksmbd_user_session_put(work->sess);
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-11-05 5:15 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-04 10:02 [PATCH] ksmbd: fix leak of transform buffer on encrypt_resp() failure Qianchang Zhao
-- strict thread matches above, loose matches on Subject: below --
2025-11-04 14:09 Qianchang Zhao
2025-11-04 14:11 Qianchang Zhao
[not found] <2025110432-maimed-polio-c7b4@gregkh>
2025-11-04 10:03 ` Qianchang Zhao
2025-11-04 11:51 ` Namjae Jeon
2025-11-04 14:12 ` Qianchang Zhao
2025-11-05 5:14 ` Namjae Jeon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox